Newsletters: Newsbites

SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.

Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.

Volume IX - Issue #60

July 31, 2007

The OWASP Top Ten Web Security Threats have been updated. On Thursday (8/2/2007) at 1 PM EDT (17:00 UTC) OWASP chair, Jeff Williams will summarize the most important changes and take questions. You'll also hear about what enterprises are doing to eliminate the bulk of their web application security vulnerabilities and Ryan Berg from Ounce Labs will share with you information about how the new national examination for Java web programmers measures their security skills. Register for the free webcast: http://www.sans.org/info/12176 Alan

PS. The early registration discount for SANS Network Security in Las Vegas (September 22-30) ends on Wednesday August 8

What Seagate knows about secure storage could affect--perhaps materially improve--your company's security decisions, at a time when regulations and rising threats have made security decisions more and more critical. Find expert information about security planning, technologies, legislation, standards and news athttp://www.sans.org/info/12216. Don't wait till tomorrow. One piece of information could change everything.

SECURITY TRAINING UPDATE SANS Network Security 2007 (September 22-30, in Las Vegas) is the largest fall conference on cybersecurity with more than 40 courses and wonderful evening sessions and a big vendor exposition. Most importantly, it brings together the top rated teachers in cybersecurity in the world. How good are they? Here's what past attendees said: "This course has valuable information that can be implemented immediately in the work place." (Christopher O'Brien, Booz Allen Hamilton) "The quality of teachers, speakers, and even attendees is far superior to any other training event I've attended." (Corinne Cook, Jeppesen) "SANS provides by far the most in-depth security training with the true experts in the field as instructors." (Mark Smith, Costco Wholesale) Registration information: http://www.sans.org/ns2007/

TOP OF THE NEWS

A review of electronic voting systems commissioned by California Secretary of State Debra Bowen has been released, and the results are "not encouraging." The researchers were able to get around physical and software security in every system tested. In several cases, they were able to "circumvent the system's audit logs and directly access data on the machine." Bowen has set an August 3 deadline for determining which systems to certify for use in the 2008 presidential primary elections, which are scheduled for February 5 in California. The review took two months, with two teams of researchers - one focusing on penetration testing and the other on examining source code. In California, counties purchase their own voting systems, but those systems must be certified by the Secretary of State's office before they are used. The study found "absolutely no evidence of any malicious source code anywhere." -http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9028262-http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/07/28/VOTING.TMP&tsp=1-http://news.com.com/8301-10784_3-9752129-7.html?part=rss&subj=news&tag=2547-1_3-0-20-http://www.sos.ca.gov/elections/elections_vsr.htm[Editors' Note (Schultz, Paller): The tremendous effort of Professor Bishop and his team, all from the University of California at Davis, deserves special mention. As one of the news stories says, this was the most thorough and rigorous testing of electronic voting machines ever. At the same time, however, count on electronic voting machine companies and their proponents quickly launching a very aggressive counteroffensive in which they attack the testing and its results. ]

THE REST OF THE WEEK'S NEWS

LEGAL MATTERS

Software Engineer Arrested for Data Theft (July 29, 2007)

Police in India have arrested a software engineer for allegedly breaking into a server that belongs to the US-based company Caterpillar and taking proprietary information. M.S. Ramasamy worked at a Caterpillar office in India earlier this year. He allegedly broke into the "Research and Engineering Documents Inquiry System" and used another employee's login credentials to access and download more than 4,000 sensitive documents. -http://www.hinduonnet.com/thehindu/thscrip/print.pl?file=2007072959470300.htm&amp;date=2007/07/29/&prd=th&[Editor's Note (Shpantzer): One of the hardest things to prove is not what happened or when, but who was at the keyboard. In this case, the stolen User ID and password that were used did not throw off the investigators permanently, since there was a CCTV pointed at the terminal to visually ID the man at the keyboard during the period the files were accessed. At the end of the day, information security is a three legged stool comprised of physical, personnel and computer security. ]

Eni Oyegoke, a Nigerian man who has been a lecturer in computer security at the University of Glamorgan in South Wales, UK, was sentenced to two years in jail after admitting to fraud, deception and theft offenses. Oyegoke applied for a British driving license with a false passport number. When police searched his home, they found a phony driving license as well as evidence that he had made nearly GBP 22,000 (US $44,683) in fraudulent credit card charges using his former landlords' identities. He came to Wales as a PhD student in 2005 and soon after began lecturing in the computer science department about identity theft. Oyegoke maintains the phony license was made as part of his graduate thesis. It is likely that he will be deported once his jail term is complete. -http://news.bbc.co.uk/2/hi/uk_news/wales/south_east/6917965.stm-http://icwales.icnetwork.co.uk/southwalesecho/news/tm_headline=university-speaks-out-over-id-fraud&method=full&objectid=19529398&siteid=50082-name_page.html[Editor's Note (Weatherford): It sounds like his day job conflicted with his noble aspirations to be a good citizen. Intelligence is a terrible thing to waste although this could lend credence to creating a technology category for the annual "Darwin Award." ]

WORMS, ACTIVE EXPLOITS, VULNERABILITIES & PATCHES

Botmasters Turn to Dynamic IP Addresses (July 28 & 17, 2007)

Always on the lookout for ways to prolong the life of their attacks, botmasters are starting to use a new technique dubbed fast-flux to make it harder to track them down. Instead of communicating with their zombie PCs through IRC, botmasters have begun to take advantage of load balancing and resiliency techniques used by legitimate companies to hide behind dynamically changing IP addresses. The "infected machines serve as proxies ... for malicious websites." IP-based blocking is ineffective against this technique. -http://www.eweek.com/print_article2/0,1217,a=212440,00.asp-http://www.forbes.com/technology/2007/07/17/symantec-security-bot-tech-cx_0717darkreading.html[Editor's Note (Skoudis): This is a really interesting development for the bad guys in improving the resiliency of their bot-nets. As bot-nets grow ever bigger, pushing the envelope toward multiple millions of machines, the attackers are encountering the same problems with massively distributed computing that big enterprises have faced for the last twenty years. It makes sense for the attackers to borrow the ideas that enterprises perfected for creating resilient, patchable, manageable, large-scale computing systems, and I expect to see a lot more of those ideas incorporated into bots going forward. (Ullrich): This new phenomenon, sometimes referred to as "flux" is the next malware challenge. Domain name registrars hold the keys to the solution. Sadly, not all of them step up to the challenge and even a small number of uncooperative registrars are able to cause a lot of pain. ]

Yahoo! Widgets Flaw (July 27, 2007)

A critical remote code execution flaw in Yahoo! Widgets is due to "a boundary error within the YDPCTL.dll ActiveX control when handling the 'GetComponentVersion()' method." The vulnerability has been confirmed in YDPCTL.dll version 2007.4.13.1 in Yahoo! Widgets version 4.0.3, which also goes by the name "build 178". Other versions of Widgets may be affected was well. Users are urged to update their Widget software to version 4.0.5. In the next few weeks, users will start to receive prompts to download the new version when they launch the application. "Yahoo! Widgets are software plug-ins that allow information [such as weather reports and sports scoreboards ] to be delivered to a user's desktop." -http://www.vnunet.com/vnunet/news/2195121/yahoo-widgets-hit-highly-http://www.scmagazine.com/us/news/article/673773/activex-vulnerability-hits-yahoo-widgets/

ATTACKS, INTRUSIONS, DATA THEFT & LOSS

A laptop stolen from the Yuba County (CA) Health and Human Services Building contains personally identifiable information of approximately 70,000 individuals whose cases were opened before May 2001. The data were on the laptop because it "was being used as a backup system for the county's computer system." The data include Social Security numbers (SSNs) and driver's license numbers. The Yuba County Department of Health and human services has begun notifying affected clients by mail. -http://www.appeal-democrat.com/news/county_51837___article.html/information_brown.html

Stolen Laptop Holds Student Loan Data (July 27, 2007)

A stolen laptop contains personally identifiable information of 5,184 American Education Services (AES) student loan customers. Most of those affected by the breach are thought to be from Pennsylvania. The computer was stolen from the Livermore, California headquarters of subcontractor Vista Financial, Inc. The data include names, addresses and SSNs, and were not encrypted. AES has sent notification letters to the affected customers. Vista was found to be violating both AES's and its own security policies. -http://www.post-gazette.com/pg/07208/804836-96.stm

A former benefits administration company employee has been arrested and charged with prescription fraud. Melissa Lea McDevitt allegedly stole Virginia Beach city and school district employees' personal information and used it to commit prescription fraud. The breach affects approximately 2,000 employees. Police discovered a list of names and SSNs at the suspect's home. McDevitt was formerly employed at Flexible Benefits Administrators, a City of Virginia Beach Contractor. Affected employees have been notified. -http://www.wtkr.com/Global/story.asp?S=6850947

Stolen Laptop Contains Aflac Customer Data (July 26, 2007)

A laptop stolen from an insurance agency employee in Japan holds personally identifiable information of approximately 152,000 Aflac supplemental health insurance customers. The computer was stolen on July 17; Aflac notified affected customers before disclosing the theft to the media. The data on the computer are encrypted and password protected. -http://www.bloomberg.com/apps/news?pid=20601101&sid=afw8zxz12Koo

Marines' SSNs Unintentionally Posted to Internet (July 26, 2007)

Personally identifiable information of 10,554 US Marines was inadvertently posted to the Internet. The data were in the possession of Penn State University, which had obtained them under a research contract. The data include names and SSNs; the problem was discovered by a Marine who had Googled his own name. Penn State officials took the information off the Internet as soon as they learned of the situation and Google has deleted the data from its cache. -http://www.marinecorpstimes.com/news/2007/07/marine_data_exposed_070726/[Editor's Note (Honan): This story highlights the dangers of using live data for any research and test purposes. Where possible data used for research and testing should be anonymised. Indeed, under EU Data Protection Legislation any companies based in the EU should ensure that test/research data is anonymised and where actual data needs to be used, then it should be treated with the same due care as live data. ]

Ohio Intern Says He Is a Scapegoat (July 25, 2007)

The intern in the Ohio database backup tape theft has issued a statement in which he refers to himself as a "scapegoat." Jared Ilovar maintains he was merely following instructions to "bring these back tomorrow" when he took the data tapes home and that he was never instructed how to handle or store them. Ilovar also says he was following instructions from his employer when he did not tell the police the tapes contained sensitive data. Ilovar says he will ask for written instructions in the future. -http://www.dispatch.com/dispatch/content/local_news/stories/2007/07/25/ilovar_email.html

Eugene Schultz, Ph.D., CISM, CISSP is CTO of High Tower Software and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Advisory Capability (CIAC).

John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.

Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.

Howard A. Schmidt served as CSO for Microsoft and eBay and as Vice-Chair of the President's Critical Infrastructure Protection Board.

Ed Skoudis is co-founder of Intelguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.

Tom Liston is a Senior Security Consultant and Malware Analyst for Intelguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.

Bruce Schneier has authored eight books -- including BEYOND FEAR and SECRETS AND LIES -- and dozens of articles and academic papers. Schneier has regularly appeared on television and radio, has testified before Congress, and is a frequent writer and lecturer on issues surrounding security and privacy.

Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.

Mark Weatherford, CISSP, CISM, is the Chief Information Security Officer for the State of Colorado.

Alan Paller is director of research at the SANS Institute

Clint Kreitner is the founding President and CEO of The Center for Internet Security.

Rohit Dhamankar is the Lead Security Architect at TippingPoint, a division of 3Com, and authors the critical vulnerabilities section of the weekly SANS Institute's @RISK newsletter and is the project manager for the SANS Top20 2005 and the Top 20 Quarterly updates.

Koon Yaw Tan is Assistant Director at Monetary Authority of Singapore (MAS) and a handler for the SANS Institute's Internet Storm Center.

Chuck Boeckman is a Principal Information Security Engineer at a non-profit federally funded research and development corporation that provides support to the federal government.

Gal Shpantzer is a trusted advisor to several successful IT outsourcing companies and was involved in multiple SANS projects, such as the E-Warfare course and the Business Continuity Step-by-Step Guide.

Brian Honan is an independent security consultant based in Dublin, Ireland.

Roland Grefer is an independent consultant based in Clearwater, Florida.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/